From 98d90f745d35d5d07bffcb46788b50e05eea56c6 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 27 Aug 2019 23:36:56 +0200
Subject: [PATCH] bpo-37951: Lift subprocess's fork() restriction (GH-15544)

---
 Doc/library/subprocess.rst                                 | 7 +++++++
 Doc/whatsnew/3.8.rst                                       | 6 ++++++
 .../next/Library/2019-08-27-10-03-48.bpo-37951.MfRQgL.rst  | 2 ++
 Modules/_posixsubprocess.c                                 | 6 ++++--
 4 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2019-08-27-10-03-48.bpo-37951.MfRQgL.rst

diff --git a/Doc/library/subprocess.rst b/Doc/library/subprocess.rst
index 7e1e3f942c1..167ed9a6ead 100644
--- a/Doc/library/subprocess.rst
+++ b/Doc/library/subprocess.rst
@@ -483,6 +483,13 @@ functions.
       The *start_new_session* parameter can take the place of a previously
       common use of *preexec_fn* to call os.setsid() in the child.
 
+   .. versionchanged:: 3.8
+
+      The *preexec_fn* parameter is no longer supported in subinterpreters.
+      The use of the parameter in a subinterpreter raises
+      :exc:`RuntimeError`. The new restriction may affect applications that
+      are deployed in mod_wsgi, uWSGI, and other embedded environments.
+
    If *close_fds* is true, all file descriptors except :const:`0`, :const:`1` and
    :const:`2` will be closed before the child process is executed.  Otherwise
    when *close_fds* is false, file descriptors obey their inheritable flag
diff --git a/Doc/whatsnew/3.8.rst b/Doc/whatsnew/3.8.rst
index cd31cf6db6e..bcdb60d86d8 100644
--- a/Doc/whatsnew/3.8.rst
+++ b/Doc/whatsnew/3.8.rst
@@ -1531,6 +1531,12 @@ Changes in the Python API
   non-zero :attr:`~Popen.returncode`.
   (Contributed by Joannah Nanjekye and Victor Stinner in :issue:`35537`.)
 
+* The *preexec_fn* argument of * :class:`subprocess.Popen` is no longer
+  compatible with subinterpreters. The use of the parameter in a
+  subinterpreter now raises :exc:`RuntimeError`.
+  (Contributed by Eric Snow in :issue:`34651`, modified by Christian Heimes
+  in :issue:`37951`.)
+
 * The :meth:`imap.IMAP4.logout` method no longer ignores silently arbitrary
   exceptions.
 
diff --git a/Misc/NEWS.d/next/Library/2019-08-27-10-03-48.bpo-37951.MfRQgL.rst b/Misc/NEWS.d/next/Library/2019-08-27-10-03-48.bpo-37951.MfRQgL.rst
new file mode 100644
index 00000000000..18e4c620bde
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2019-08-27-10-03-48.bpo-37951.MfRQgL.rst
@@ -0,0 +1,2 @@
+Most features of the subprocess module now work again in subinterpreters.
+Only *preexec_fn* is restricted in subinterpreters.
diff --git a/Modules/_posixsubprocess.c b/Modules/_posixsubprocess.c
index 60c8eab90a1..f68d362acc0 100644
--- a/Modules/_posixsubprocess.c
+++ b/Modules/_posixsubprocess.c
@@ -583,8 +583,10 @@ subprocess_fork_exec(PyObject* self, PyObject *args)
             &restore_signals, &call_setsid, &preexec_fn))
         return NULL;
 
-    if (_PyInterpreterState_Get() != PyInterpreterState_Main()) {
-        PyErr_SetString(PyExc_RuntimeError, "fork not supported for subinterpreters");
+    if ((preexec_fn != Py_None) &&
+            (_PyInterpreterState_Get() != PyInterpreterState_Main())) {
+        PyErr_SetString(PyExc_RuntimeError,
+                        "preexec_fn not supported within subinterpreters");
         return NULL;
     }